HTTP: Malformed EMF File

This signature detects attempts to exploit a known vulnerability against Microsoft Windows. A vulnerability exists in the rendering of Enhanced Metafile (EMF) image format that could allow remote code execution. If a user opened a malicious EMF file, they could be compromised. Windows 2000, Windows 2003, Windows 2003 SP1, Windows NT4, Windows NT4 Terminal Server Edition, Windows Vista, Windows XP, and Windows XP SP2 are affected.

Extended Description

Microsoft Windows Graphics Rendering Engine is prone to a local privilege-escalation vulnerability when rendering malformed EMF image files. An attacker may exploit this issue to execute arbitrary code with SYSTEM-level privileges, facilitating the complete compromise of affected computers.

Affected Products

Avaya messaging_application_server,Microsoft windows_server_2003_datacenter_x64_edition

References

BugTraq: 106083 23278

CVE: CVE-2022-34728

URL: http://www.microsoft.com/technet/security/Bulletin/MS07-017.mspx http://www.frsirt.com/english/advisories/2007/1215 http://www.securitytracker.com/id?1017844 http://www.zerodayinitiative.com/advisories/zdi-19-555/ https://www.seljan.hu/posts/out-of-bounds-read-information-disclosure-vulnerability-in-microsoft-windows-gdi-emr_setpixelv-record/

Short Name

HTTP:STC:IMG:MAL-EMF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Malformed EMF File

Extended Description

Affected Products

References

Found a potential security threat?